CRITICAL 9.9 GitHub

CVE-2025-53837

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

### Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. This can be demonstrated by adding

Affected Products

maven/org.xwiki.rendering:xwiki-rendering-xml < 14.10.2

References

Published: 2026-09-18 · Source: GitHub · Feed updated: 2026-09-18

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-09-18 via GitHub. Affected: maven/org.xwiki.rendering:xwiki-rendering-xml < 14.10.2.

Risk Timeline

CVE Disclosed2026-09-18 · -1 days ago

Remediation Resources

GitHub

github.com/advisories/GHSA-26vp-8gxg-v4pg

GitHub

github.com/xwiki/xwiki-rendering/security/advisories/GHSA-26vp-8gxg-v4

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2026-11746	Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fa	CRITICAL	—
CVE-2026-73247	Kestra: SSRF via Pebble http() function allows unauthenticated access to interna	HIGH	8.6
CVE-2026-11745	Central Dogma: SSH host-key verification permanently disabled in Git mirror (Ssh	HIGH	—
CVE-2026-73245	Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env	MEDIUM	6.5
CVE-2026-11748	Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authent	MEDIUM	—

vulnfeed aggregates 14509 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.